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METHOD OF MONITORING THE ACTIVATION OF PROGRAMMED 
SEQUENCES OF A PROGRAMMED SYSTEM AND COMPUTER PROGRAM 
AND APPARATUS FOR IMPLEMENTING SAME 
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Background of the invention . 
1- Field of the invention. 

The present invention relates to software 
controlled systems, and more particularly to means for 
monitoring the proper execution of programmed sequences 
triggered by an external or internal event. 

A software controlled system may be required to 
perform background tasks in response to certain 
specific triggering events, such as a signal received 
from an outside source, a timing signal from built-in 
% timer, etc. These events must often be processed as 

jij soon as they arrive. This gives rise to an 

111 interruption in a main program: an event comes up 

yl 15 causing an interrupt routine to be executed, after 

which the system returns to its main program. In other 
U words, an interrupt routine is a set of instructions 

H which is triggered in response to the arrival of an 

:*! event and causes an interruption in main program. 

% 20 2. prior art 

In the prior art, a problem arises when a 
programmed system such as a microprocessor or 
microcontroller unit (MCU) operates in a noisy 
environment susceptible of upsetting the execution of 
its program. As an example, this situation can arise 
in a monitor display unit housing a display device, 
such as a cathode ray tube (CRT) , and microprocessor- 
controlled drive circuitry. The latter is used both to 
interface the display device with the video input and 
to provide user functions for controlling display 
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parameters (e.g. contrast, color, brightness, image 
distortion correction, image positioning etc.) through 
pushbuttons and/ or on screen menus. 

In this environment, the high voltages generated 
5 for the CRT can produce electrostatic or 
electromagnetic noise, often in the form of - spikes, 
that can deprogram or corrupt internal circuits or 
peripheral circuits of the microcontroller, such as the 
program registers, internal memory etc. When this 

10 happens, there is no automatic diagnostic tool which 
can inform of the failure. In particular, a noise- 
induced disruption can stop or prevent the execution of 
one or several interrupt routines. In the example, 
this could cause the monitor to become blocked in an 

15 undetermined or even dangerous state. 

summary of the invention with objects, 
in view of the foregoing, it is an object of the 
invention to provide means capable of ensuring that 
interrupt routines that are critical for the operation 

20 of a programmed system can be monitored systematically 
and reliably. 

The invention achieves this object by an approach 
based on using the different interrupt routines of a 
programmed system to monitor each other. In this way, 

25 a failure in the execution of a monitored interrupt 
routine would be detected by another interrupt routine 
(this one having been correctly triggered) . The 
detection can then be used to reset or reboot the 
program and thus resume normal functioning on a sound 

30 basis - 

According to a first aspect, the invention provides 
a method of monitoring the activation of programmed 
sequences of a programmed system comprising at least a 
first and a second programmed seguence, each to be 
35 executed iteratively, wherein the first programmed 
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sequence is made to monitor the execution of the second 
programmed sequence, and the second programmed sequence 
is made to monitor the first programmed sequence. 

The programmed sequences are advantageously taken 
5 from the group consisting of: routines, such as 
interrupt routines, and main program loops* For 
instance, it may comprise at least one interrupt 
routine triggered by an event generated by a timer or 
an external signal. 

10 In a preferred embodiment, the first programmed 

sequence incorporates the steps of resetting a first 
counter associated therewith and incrementing a second 
counter associated with the second programmed sequence , 
and the second programmed sequence incorporates the 

15 steps of resetting the second counter and incrementing 
the first counter, a failure in the activation of a 
particular programmed sequence being detected when a 
counter associated with that sequence reaches a 
predetermined threshold . 

20 The predetermined threshold for a given counter can 

be established so as to be reached upon just one 
failure of the associated programmed sequence to reset 
that counter, 

A detected failure in the activation of a 
25 programmed sequence can be made to cause a complete or 
partial reset of the programmed system. 

According to a second aspect, the invention 
provides a method of monitoring the activation of N 
programmed sequences in a programmed system / each to be 
30 executed iteratively, N being an integer greater than 
1, wherein each of the N programmed sequences is 
monitored by at least one other programmed sequence. 

Each of the N programmed sequences may in this way 
be monitored by each of the N-l other programmed 
35 sequences- 
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This can be achieved by having each programmed 
sequence perform the monitoring function by 
incrementing a value in a respective counter associated 
with each programmed sequence it monitors and by 
5 checking, for each counter, that the corresponding 
value has not reached a predetermined threshold, each 
monitored programmed sequence resetting the counter 
associated therewith, so that a failure in the 
activation of a particular programmed sequence is 
10 detected when a counter associated with that sequence 
reaches a predetermined threshold. 

According to a third aspect, the invention provides 
a computer program comprising at least a first and a 
second programmed sequence, each to be executed 
15 iteratively, wherein the first programmed sequence 
incorporates instructions for monitoring the execution 
of the second programmed sequence, and the second 
programmed sequence incorporates instructions for 
monitoring the first programmed sequence. 
20 According to a fourth aspect, the invention 

provides a computer program comprising N programmed 
sequences, each to be executed iteratively, N being an 
integer greater than 1, wherein each of the programmed 
sequences is monitored by at least one other programmed 
25 sequence. 

According to fifth aspect, the invention provides a 
medium containing the aforementioned program. 

According to a sixth aspect, the invention provides 
a programmed apparatus for executing iteratively at 

30 least a first and a second programmed sequence, 
comprising first means associated with the first 
programmed sequence to monitor the execution of the 
second programmed sequence, and second means associated 
with the second programmed sequence to monitor the 

35 first programmed sequence. 
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According to a seventh aspect, the invention 
provides an apparatus for executing at least N 
programmed sequences, each to be executed iteratively, 
N being an integer greater than l, wherein each of the 
5 N programmed sequences is monitored by at least one of 
the N-l other programmed sequences. 

The apparatus can be made to implement the optional 
features mentioned above in the context of the method . 
Brief description of the drawings 
10 The invention and its advantages shall be more 

clearly understood from reading the following detailed 
description of the preferred embodiments, given purely 
as non-limiting examples, with reference to the 
appended drawings in which: 
15 " Fig.l is a symbolic representation of a 

programmed system for executing a main program loop and 
triggered routines, in which the invention can be 
implemented; 

- Fig, 2 is a diagram showing a CRT monitor unit in 
20 which the exemplary embodiment is implemented, 
connected to a personal computer (PC) ; and 

~ Fig. 3 is a flow chart showing how two routines 
can monitor each other in accordance with the 
invention. 

Q 25 Detailed description of the preferred embodiments. 

An example of a programmed system in which the 
invention can be implemented is illustrated 
symbolically in Fig. l. The programmed system 2 is 
e.g. a microprocessor or microcontroller unit (MCU) set 

30 to execute a program stored in a main memory area (not 
shown) by means of an arithmetic logic unit ALU - Here, 
the program is composed of a main program loop ML and N 
interrupt routines Rl-RN. The main program loop ML 
forms the core of the stored program insofar as it is 

35 executed systematically and cyclically. The interrupt 
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routines ri-rn are parts of the program that are 
executed upon being called. In the example, these 
routines Rl-RN are called by respective events Il-IN, 
referred to as interrupt events. The interrupt events 
5 can be external, such as control or detection signals 
supplied to the programmed system, or internal, e.g. 
from built-in timers. 

In the absence of interrupt events, the ALU 
executes the main program loop from a starting point SP 
io to an end point EP, looping back from the latter to the 
starting point. The stepping through the main program 
loop is performed by a pointer P which reads 
sequentially through instructions stored in a main 
program register 4 . 
15 Upon occurrence of an interrupt event, the ALU 

immediately interrupts the main program loop ML to 
execute instead the corresponding routine. It 
thereafter returns to the main program loop ML from the 
point it left off at the interruption to resume 
20 execution of the main program loop. 

In the illustrated example, the pointer P is at 
instruction k of the main program loop ML when an 
interrupt event Ii appears, in response , the 

programmed system brings the pointer P immediately to 
25 the start point of a portion where the corresponding 
routine Ri is stored (arrow 6) so as to step through 
the program instructions of the latter. Once the end 
point of routine Ri is reached, the pointer P is 
returned to instruction k of register 4 (arrow 8) to 
30 resume execution of the main program loop (assuming 
that instruction k was not executed at the time of 
interruption) . The interrupt and routine execution 
procedures are the same for any of the other routines 
Rl-RN- 
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There shall now be explained how the invention can 
be implemented in such a programmed system. However, 
to simplify the description, only two interrupt 
routines (designated Rl and R2) shall be considered. 
It shall be assumed that each of these two routines is 
called up at regular intervals by interrupt events II 
and 12, produced e.g. by timer signals. 

In the example, the programmed system 2 happens to 
be installed in a CRT monitor unit 10 connected to a PC 
12 via a cable link 14, as shown in Fig. 2. The CRT 
monitor unit includes a CRT together with its high- 
voltage drivers which constitute a source of 
electromagnetic or electrostatic discharge (ESD) noise 
spikes. This noise can cause some of the interrupt 
15 routines to fail, e.g. by not responding to their 
interrupt events. The embodiment serves to ensure that 
such a failure can be detected and appropriate measures 
can be taken in response, e.g. by resetting the 
microcontroller . 
20 The programmed system is based on a microcontroller 

unit (Mcu) configured to manage the housekeeping and 
user functions of the monitor unit. 

In particular, interrupt routine Rl is programmed 
to cooperate with circuitry for periodically sensing 
25 the presence of line and/or frame synchronization 
signals sent by the PC on the cable link 14 , in order 
to set the monitor in a standby or energy saving mode 
automatically in the absence of these signals. 

Interrupt routine R2 is programmed to scan 
periodically the state of a control panel 16 at the 
front of the display in order to react appropriately 
upon activation of a pushbutton or similar adjusting 
device 18. Typically, the control panel 16 allows the 
user to set the display brightness, contrast, geometric 
35 distortion correction, degaussing, etc. 
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Note that the interrupt event is not the 
disappearance of the synchronization signals or the 
activation of a pushbutton, but periodic signals to 
start the respective routines Rl and R2 . These signals 
5 can be produced by a timer which is either internal or 
external to the microcontroller. 

The main program loop ML takes care of the normal, 
steady-state operation of the monitor. 

In accordance with the invention, interrupt 
10 routines Rl and R2 are provided with the additional 
function of mutually monitoring each other- 
Specifically, routine Rl is also programmed to check 
that routine R2 is periodically triggered for scanning 
the state of the control panel 16, and routine R2 is 
is also programmed to check that routine Rl is 
periodically triggered for sensing the presence of the 
synchronization signals. 

It shall be assumed that in normal, error-free, 
operation routine Rl is triggered every l millisecond 
20 (by interrupt event II) and routine R2 is triggered 
every 10 milliseconds (by interrupt event 12), 

Fig. 3 is a flow chart showing how the mutual 
monitoring is implemented for each of the routines Rl 
and R2 . The concept is based on each routine causing a 
25 counter in the other routine to be incremented while 
resetting to zero its own counter, and determining a 
failure condition if the counter of the other routine 
reaches a maximum admissible value, 

in the example, the mutual monitoring functions are 
30 implemented before the execution of the routines per 
se. Considering the case of routine Rl, say, the 
procedure starts by resetting to zero an internal 
counter 1 associated to routine Rl (step S2). This 
counter is incremented by one unit each time routine R2 
35 is activated. 
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Next, the value in the internal counter 2 of 
routine R2 is compared with a maximum admissible value 
MAXI (step S4). if counter 2 has not reached this 
value, it is deduced that this is because routine R2 
was triggered when it was last expected to be 
triggered, so resetting counter 2 in the process before 
the value MAXI could be attained . 

The value of counter 2 is then incremented by one 
unit (step S6) . 

Thereafter, the routine per se is executed, i.e. 
sensing the presence of the line and frame 
synchronization signals (step S8) . 

If the comparison step S4 reveals that counter 2 
has reached the maximum value MAXI, it is deduced that 
routine R2 has not been triggered the last time it 
should have been, and thus could not reset in time that 
counter 2 to zero. Upon detecting this failure to 
trigger routine R2 , the procedure causes the 
microcontroller to reset (step S10) . 

The mutual monitoring procedure at the level of 
routine R2 mirrors that of Rl, with counter 1 changed 
to counter 2 and vice versa; equivalent steps in the 
flowchart are designated with the same reference 
numerals, followed by a prime sign. Thus, counter 2 is 
reset to zero at step S2 1 , the comparison step S4 1 is 
carried out with the value of counter 1, and counter 1 
is incremented at step S6 r * 

Table I below summarizes the evolution of values in 
counters 1 and 2 over successive triggering^ of 
routines Rl and R2 when no failure occurs. 

Table I: evolution of counter l and 2 values. 

Normal operation: routine Rl interval = 1 ms, 
Routine R2 interval = 10 ms- 

RQDt.i TIP! Counter 1 Pnuntpr ? 
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It can be seen that for a comparison value MAXI set 
to 10 or more, none of the counters ever reaches that 
value under error free operation. 

For MAXI = 10 in the comparison step S4 of routine 
Rl, a failure to trigger routine R2 shall be detected 
by routine Rl less than one millisecond later. 

On the other hand, if the same value MAXI = 10 is 
used in the comparison step S4 1 of routine R2, a 
similar failure to trigger routine Rl shall be detected 
25 by routine R2 only after 10 x 10 millisecond intervals. 
If this interval is too long, it is possible to use a 
smaller value for MAXI in routine R2 , for instance 2. 
In general, it can be envisaged to have a specific 
comparison value MAXIl f MAXI2 , etc. for the comparison 
steps S4, S4» etc. in the different routines, to suit 
requirements - 

An example is given below of a program written in C 
language for executing the monitoring functions in each 
of the routines Rl and R2. 
35 MONITORING BY ROUTINE Rl 
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{ 

COUNTER1=0; 
if (COUNTER2<MAXI) 
COUNTER2++; 

5 else 

RESET_MCU; 

} 

MONITORING BY ROUTINE R2 
{ 

10 COUNTER2=0,- 

if (COUNTERKMAXI) 
COUNTER1++; 

else 

RESETJKCU; 

15 } 

The above description can easily be extrapolated to 
any arbitrary number N of subroutines each monitoring 
each other. 

For instance, each of the N routines of Fig.l can 
20 be programmed to monitor the N-l other routines. In 
this case, steps S4 and S6 of figure 3 would be 
repeated for each of the monitored routines, so that in 
the case of routine Ri, say, we would have: for i = 2 
to N, "counter i < MAXIi ?" and "counter i = counter 
25 i+1", with a branching to reset the microcontroller 
(step S10) for a negative answer at any one of steps 
S4. 

It is also possible to arrange for each of the N 
routines involved in the monitoring procedure to 
30 monitor just one or a group of other routines. For 
instance a routine Ri can be set to monitor just 
routine Ri+1, with routine RN monitoring routine Ri to 
provide the "round robin" condition. 

Moreover, the monitoring according to the invention 
35 need not be limited to routines among themselves. It 
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can also involve one or several main program loops ML 
in the mutual monitoring function. For instance, in 
the example of figure 1, the main program loop ML can 
also include a set of program instructions to perform 
5 the steps S4 and S6 of figure 3 for each or some of the 
N routines Rl-RN, as explained above. in this way, the 
main program loop can actively monitor each of the 
routines and cause a reset of the microcontroller 
should one or a number of these routines fail. This 
io function can be useful for situations where a fault 
causes a crash of all the interrupt routines RI-rn , but 
not the main program loop. 

Conversely, each or some of the interrupt routines 
Rl-RN can be made to monitor the main program loop ML. 
The latter would then also have its own counter that 
would be reset at each cycle of the main program loop 
and be incremented by the monitoring routines. 

It will be understood that where a routine or main 
program loop is monitored by more than other, the value 
MAXI for that loop should be adapted accordingly. 

The action taken when a failure is detected need 
not necessarily be the resetting of a microcontroller. 
It can be any action suited to circumstances and to the 
characteristics of the routine or the part of the 
25 program in which the failure was detected to occur. 
For instance, the action can to trigger an alarm, send 
a warning message, switch over to a backup program, 
reset just a portion of the system, etc. These actions 
can also be different according to what is being 
30 monitored, in which case the routines Rl-RN, arid 
possibly the main loop ML, would adapt their action at 
step S10 depending on the routine being monitored. 

The interrupt routines need not necessarily be 
triggered at intervals which are regular to be given a 
35 monitoring role. The only requirement is that the 



16/11 00 JEU 14:55 FAX 33 1 45019828 CBT BALLOT SCHMIT FLEIT BONG IN I ©014 



o 

-A 

: . 



10 



« 15 



13 

routine triggering event be relatively repetitive and 
expected . For instance, the event may normally be 
expected to occur at variable intervals with a maximum 
interval beyond which it can reasonably be assumed that 
an interrupt has not been triggered. in this way, the 
routine (s) which monitor (s) the one expected to respond 
would generate an alarm or program a reset when this 
maximum interval is exceeded. 

It is clear that the primary functions of the 
routines are immaterial and that the invention can be 
implemented in all sorts of different applications. 
For instance, in the described example, other loops 
involved in the monitoring function can have as their 
primary function a timer arranged to cause an indicator 
light to flash, or to read the state of a specific 
circuit portion to report on its condition, etc. 

In a broader context, the invention is useful for 
monitoring routines and program loops in practically 
every area of computer operated systems : machine 
20 control, communications, data exchange, consumer 
electronics, professional electronics, PC software, 
office and business management and accountancy computer 
programs , etc . 

While the invention has been described in 
25 connection with a preferred embodiment, it is to be 
understood that the invention is not limited to the 
disclosed embodiment but, on the contrary, is intended 
to cover various modifications and equivalent 
arrangements included within the spirit and scope of 
30 the appended claims. 



